Loading npm security reports…

@cexy/wonfca@1.1.9: Malicious npm security report (Block) | LPM Firewall

registry / @cexy/wonfca / 1.1.9

@cexy/wonfca@1.1.9

Unofficial Facebook Chat API for Node.js - Interact with Facebook Messenger programmatically

AI Security Review

scanned 21d ago · by lpm-firewall-ai

Calling login() with Facebook email and password, or loginViaAPI/tokensViaAPI, posts those secrets to https://minhdong.site instead of Facebook. The unofficial host is the compiled default and is used by the standard password login helper.

Static reason

One or more suspicious static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

A consumer calls login() with email and password, calls loginViaAPI or tokensViaAPI, or session recovery uses credentials from fca-config.json.

Impact

Facebook email, password, and optional 2FA secret are disclosed to minhdong.site, which can yield session cookies and account takeover.

Mechanism

Password login relayed to a hardcoded unofficial credential gateway

Attack narrative

When an app logs in with Facebook email and password, this library does not submit those secrets to Facebook. makeLogin calls tokens(), which always calls tokensViaAPI, which POSTs email, password, and optional 2FA to https://minhdong.site/api/v1/facebook/login_ios. That host is the compiled default apiServer in both the CommonJS and ESM bundles. Cookies returned by the unofficial service are then applied to Facebook, so the third party receives account credentials while the bot appears to log in normally.

AI rationale

Password login is silently sent to a hardcoded unofficial gateway rather than Facebook, which is concrete credential theft. Missing install hooks and optional npm update install do not remove that runtime attack.

Evidence

dist/index.jsdist/index.mjs

Network endpoints2

minhdong.site

Source & flagged code

7 flagged · loading source

dist/index.jsView file

16567var import_node_https = __toESM(require("https")); L16568: var import_node_child_process = require("child_process"); L16569: init_package();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16567

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L36

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.8 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fe87d011538dade4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @cexy/wonfca@1.1.8 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.8 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs.writeFileSync(targetPath, payload, "utf8"); const url2 = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com... return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || ""; fs2.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8"); const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`; urlBase: baseUrl, urlBase: baseUrl, headers: token ? { Authorization: `Bearer ${token}` } : void 0

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.8 matchedPath = dist/index.mjs matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg

Source & flagged code

7 flagged

dist/index.jsView file

16567var import_node_https = __toESM(require("https")); L16568: var import_node_child_process = require("child_process"); L16569: init_package();

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L16567

36// src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36"; L1526: const referer = options?.referer ||

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L36

36Cross-file remote execution chain: dist/index.js spawns dist/index.mjs; helper contains network access plus dynamic code execution. L36: // src/func/logger.ts L37: function writeStdout(message) { L38: process.stdout.write(`${message} L39: `); ... L55: function getTheme() { L56: const fromEnv = String(process.env.FCA_LOG_THEME || "").toLowerCase(); L57: if (fromEnv === "minimal") return "minimal"; ... L135: const parts2 = parseLabel(message, "READY"); L136: const bodyOut2 = parts2.label === "READY" ? formatSuccessBody(parts2.body, grad, styles.text) : grad ? grad.coolStatus(parts2.body) : styles.text(parts2.body); L137: const labelOut2 = grad ? grad.coolStatus(padLabel(parts2.label)) : styles.text(padLabel(parts2.label)); ... L1525: const ua = options?.userAgent || "Mozilla/5.0 (Windows NT

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L36

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.8 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.jsView on unpkg

•matchType = malicious_source_fingerprint_signature signature = fe87d011538dade4 signatureType = suspicious_hashes sourceLabel = final_verdict:malicious matchedPackage = @cexy/wonfca@1.1.8 matchedPath = dist/index.js matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.8 similarity = 1.000 shingleOverlap = 5 summary = package final verdict is malicious

High

Known Malware Source Fingerprint Signature

Source fingerprint signature matches a known malicious package signature; route for source-aware review.

dist/index.jsView on unpkg

dist/index.mjsView file

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.mjs: fs.writeFileSync(targetPath, payload, "utf8"); const url2 = res?.request?.res?.responseUrl || (res?.config?.baseURL ? new URL(res.config.url || "/", res.config.baseURL).toString() : res?.config?.url || "https://www.facebook.com... return cfg2?.baseURL ? new URL(cfg2.url || "/", cfg2.baseURL).toString() : cfg2?.url || ""; fs2.writeFileSync(filePath, JSON.stringify(appState, null, 2), "utf8"); const baseUrl = `https://www.facebook.com/ajax/mercury/upload.php?${query.join("&")}`; urlBase: baseUrl, urlBase: baseUrl, headers: token ? { Authorization: `Bearer ${token}` } : void 0

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.mjsView on unpkg

•matchType = normalized_sha256 matchedPackage = @cexy/wonfca@1.1.8 matchedPath = dist/index.mjs matchedIdentity = npm:QGNleHkvd29uZmNh:1.1.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/index.mjsView on unpkg